CVE-2006-6365

SQL injection vulnerability in detail.asp in DUware DUpaypal 3.1, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the iType parameter. NOTE: the iState parameter is already covered by CVE-2005-3976 and the iPro parameter is already covered by CVE-2005-2047...

CVE-2006-6365

SQL injection vulnerability in detail.asp in DUware DUpaypal 3.1, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the iType parameter. NOTE: the iState parameter is already covered by CVE-2005-3976 and the iPro parameter is already covered by CVE-2005-2047...

CVE-2006-6367

CVE-2006-6367 describes multiple SQL injection vulnerabilities in DUware DUdownload 1.1 (and possibly earlier) specifically in detail.asp, exploitable via the iFile or action parameters (the iType parameter is covered by CVE-2005-3976). The vulnerability allows remote attackers to execute arbitra...

CVE-2006-6365

CVE-2006-6365 describes a SQL injection in DUware DUpayPal 3.1 (and possibly earlier) via the iType parameter in detail.asp, allowing remote execution of arbitrary SQL commands. Related parameters iState and iPro are covered by CVE-2005-3976 and CVE-2005-2047. The connected EUVD/NVD records corro...

CVE-2006-6367

Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 iFile or 2 action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976...

CVE-2006-6354

Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the 1 iNews, 2 iType, or 3 Action parameter. NOTE: the iType parameter in type.asp is covered by CVE-2005-3976...

CVE-2006-6355

SQL injection vulnerability in default.asp in DuWare DuClassmate allows remote attackers to execute arbitrary SQL commands via the iCity parameter. NOTE: the iState parameter is already covered by CVE-2005-2049...

CVE-2006-6354

CVE-2006-6354 and related CVEs describe multiple SQL injection vulnerabilities in DuWare DUNews (and DUNews-family) detail.asp, allowing remote attackers to inject SQL via the (1) iNews, (2) iType, or (3) Action parameters. The iType parameter in type.asp is already covered by CVE-2005-3976. The ...

CVE-2006-6354

Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the 1 iNews, 2 iType, or 3 Action parameter. NOTE: the iType parameter in type.asp is covered by CVE-2005-3976...

CVE-2006-6355

CVE-2006-6355 describes an SQL injection in DUware DUclassmate (default.asp via the iCity parameter; iState is covered by CVE-2005-2049). The issue arises from inadequate input sanitization, allowing remote attackers to execute arbitrary SQL commands. Connected sources corroborate the vulnerabili...

CVE-2006-6355

SQL injection vulnerability in default.asp in DuWare DuClassmate allows remote attackers to execute arbitrary SQL commands via the iCity parameter. NOTE: the iState parameter is already covered by CVE-2005-2049...

CVE-2006-6354: Undefined Security Weakness

Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the 1 iNews, 2 iType, or 3 Action parameter. NOTE: the iType parameter in type.asp is covered by CVE-2005-3976...

CVE-2006-6355: Undefined Security Weakness

SQL injection vulnerability in default.asp in DuWare DuClassmate allows remote attackers to execute arbitrary SQL commands via the iCity parameter. NOTE: the iState parameter is already covered by CVE-2005-2049...

CVE-2006-6365: Undefined Security Weakness

SQL injection vulnerability in detail.asp in DUware DUpaypal 3.1, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the iType parameter. NOTE: the iState parameter is already covered by CVE-2005-3976 and the iPro parameter is already covered by CVE-2005-2047...

CVE-2006-6367: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 iFile or 2 action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976...

aria-duforum.txt

Aria-Security Team Advisory Original Advisory: http://www.aria-security.com/forum/showthread.php?t=58 ----------------------------------------------------------- Software: DUdForum 3.0 Method: http://duware.com Vendor: PoC: http://target/DUforum/messages.asp?iMsg=SQL Injection...

aria-dupaypal.txt

Aria-Security Team Advisory Original Advisory: http://www.aria-security.com/forum/showthread.php?t=62 ----------------------------------------------------------- Software: DuPaypal Method: SQL Injection Vendor: http://www.duware.com/ PoC: /DUpaypal/type.asp?iType=SQL Injection...

aria-duclass.txt

Aria-Security Team Advisory Original Advisory: http://www.aria-security.com/forum/showthread.php?t=59 ----------------------------------------------------------- Software: DuClassmate Method: SQL Injection Vendor: http://www.duware.com/ PoC: http://target/default.asp?iState=SQL Injection...

aria-dudown.txt

Aria-Security Team Advisory Original Advisory: http://www.aria-security.com/forum/showthread.php?t=60 ----------------------------------------------------------- Software: DuDownload Method: SQL Injection Vendor: http://duware.com PoC: http://target/type.asp?iType=SQL Injection...

aria-portal.txt

Aria-Security Team Advisory Original Advisory: http://www.aria-security.com/forum/showthread.php?t=63 ----------------------------------------------------------- Software: DuPortal Pro 3.4 Method: SQL Injection Vendor: http://duware.com PoC:...